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REMARKS 

Reconsideration and allowance of the subject patent application are respectfully 
requested. 

As suggested in the office action, headings have been added to the specification. 
An informality on page 4 of the specification has also been corrected. 

The claims were objected to because of British spellings. As noted in MPEP 
Section 608.01, the specification must be in English, but there is no additional 
requirement that it be "American" English. Consequently, withdrawal of the claim 
objections is respectfully requested. 

Applicants acknowledge with appreciation the indication that claims 5 and 10 
contain allowable subject matter. New claim 1 1 corresponds to claim 5 written in self- 
standing independent form and is therefore believed to be allowable. 

Claims 1-4 and 6-9 were rejected under 35 U.S.C. Section 102(e) as allegedly 
being "anticipated" by Stolfo et al. (U.S. Publication No. 2003/0167402). While not 
acquiescing in this rejection or in the characterization of Stolfo et al. in the office action, 
independent claims 1 and 6 have been amended. The discussion below makes reference 
to the amended claims. 

Claim 1 recites: 

b) examining the executable attachment and comparing the 
executable attachment with the extracted structural elements [previously 
defined as being extracted from the email] to determine whether the 
executable attachment contains code, data or encoded data that could have 
created the extracted structural elements 
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Claim 1 further recites that the attachment is signaled as being possibly viral or not on the 
basis of the extent to which the examining step b) finds evidence that the structural 
elements have been created by that attachment. Claim 6 recites similar features. 

These features find support in the specification at, for example, page 1, lines 27-30 
and page 2, line 3 1 to page 3, line 5 which describe by way of example and without 
limitation that a comparison of the executable attachment with the extracted structural 
elements of the email (referred to in the specification as the "fingerprint" of the email) is 
indicative of whether the attachment is a mass mailing virus. It should be noted that this 
is effectively an internal comparison of different parts of a single email, e.g., of the 
attachment with structural elements of the email. Using such an internal comparison to 
identify a mass mailing virus is not described or suggested in the applied prior art 
document. 

Stolfo et al. relates to a system for detecting emails which contain viruses or 
otherwise violate an email security policy. Stolfo et al. teaches the use of models to 
classify groups of emails transmitted through the system. Statistics are gathered relating 
to the transmission of selected emails. A variety of different statistics are used, including 
the number of addresses to which an attachment (uniquely identified by a hash) is 
transmitted; the number of emails sent from a specific account; statistics relating to the 
email addresses of recipients; and others. The statistics for transmitted emails are then 
used to classify emails as violating the security policy or not by comparison of the 
statistics with the model. 
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Thus, Stolfo et al. discloses comparison of the statistics of plural emails with an 
external model. Stolfo et al. does not involve the idea of claims 1 and 6 of examining the 
executable attachment in comparison with the structural elements of the email. 

Regarding feature (b) of claims 1 and 6 relating to the examination of the 
executable code, the office action relies on the disclosure in paragraph [0061] of Stolfo et 
al. This paragraph discloses comparing features of the executable attachments with 
respect to an external model in order to detect a virus. However, at least taking into 
account the amendments to claims 1 and 6, Stolfo et al.'s comparison with an external 
model clearly does not meet all of the requirements of feature (b) of claims 1 and 6 for 
the reasons explained above. 

Claims 2-4 depend from claim 1 and claims 7-9 depend from claim 6. These 
claims patentably distinguish from Stolfo et al. because of these respective dependencies 
and because of the additional patentable features recited therein. 

New claims 1 1 and 12 have been added. The subject matter of these new claims 
finds support in the original disclosure and the Examiner is invited to independently 
confirm that this is the case. 

As noted above, claim 1 1 corresponds to original (allowable) claim 5 written in 
self-standing independent form and is therefore believed to be allowable. 

Claim 12 is directed to a machine programmed to process an email having an 
executable attachment. The machine is programmed, among other things, to examine an 
executable attachment and compare the executable attachment with extracted structural 
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elements from the email to determine whether the executable attachment contains code, 
data or encoded data that could have created the extracted structural elements. As 
explained above in connection with claims 1 and 6, Stolfo et al. does not disclose or 
suggest such examining or determining. Consequently, claim 12 patentably distinguishes 
over Stolfo et al. 

The pending claims are believed to patentably distinguish from the applied art and 
favorable office action is respectfully requested. 

Respectfully submitted, 



NIXON & VANDERHYE P.C. 
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